In recent years, to ensure the mutual communication security between nodes composing a network, that is, terminal devices, the art for a digital certificate has been used widely. By this art, the identity of the node of a communication destination can be confirmed, so that unfair transfer of data between the so-called “spoofing” and a node can be prevented from occurring.
The digital certificate is issued by the certificate authority (CA) which is a third party other than the concerned party of communication and a reliable organization. As a specification for the digital certificate, the one specified in ITU-TX.509 is generally known. In the digital certificate, the term of validity is set and an expired digital certificate cannot be used.
However, even if the term of validity is not expired, when the owner of the digital certificate loses the secret key concerning the digital certificate or it is stolen by another person, the reliability of the digital certificate is impaired. Therefore, the certificate authority reports and opens to the public the information concerning the serial number and so on thereof in a certificate revocation list (CRL), thereby revoking such a digital certificate whose reliability is impaired.
Further, when any attribute (for example, name or company name) of the owner of the digital certificate is changed or when the owner comes not to exist, the certificate authority revokes the digital certificate. Therefore, to enhance the certainty of the confirmation (certification) of the communication destination, it is necessary to confirm not only the contents of the digital certificate but also the revocation certificate list.
In Japanese Laid-Open Patent Application Publication No. 2004-185263, a dispersed cooperative content delivery system according to the aforementioned concept is proposed. In this system, a cache storage is installed in each client, the caches bear their share of contents to be delivered, and for actual content delivery, each of the clients transfers data mutually by using cache index provided. This is the so-called P2P (peer to peer) system.
In communication by the P2P system, the confirmation (certification) of the communication destination as mentioned above is particularly important for security and in Japanese Laid-Open Patent Application Publication No. 2004-185263 indicated above, a public key certificate used in communication is verified. However, it cannot be denied that whether the certificate is valid or not may vary depending on conditions, and it is similarly necessary to confirm the revocation certificate list each time.
However, according to Japanese Laid-Open Patent Application Publication No. 2004-185263, although the public key certificate is verified, if the policy of the sending source for verification of a certificate permits, even if not every time, within a cycle decided by the sending source, the previous verification result is used. For example, before the next sending day of a revocation list CRL, the previous verification result may be used.
That is questionable from the point of security. It is not known when and in what situation the validity of the certificate varies. When a certificate is revoked in some situation, it is desired that it is reflected timely on the, revocation list CRL and is confirmed promptly by a client in need.
Further, conventionally, each client periodically accesses the certificate authority to obtain a CRL, it is however also questionable. When the P2P network is used, there are possibilities of considerably frequent occurrences of cancellations of certificates. For example, when canceling the certificate to update the terminal device as a node, from just the moment the certificate is canceled, all the nodes must not permit connection by the certificate of the canceled node.
In a managing method for obtaining a CRL every given period, there is a fear that using a time period until the CRL is updated at each node, a malicious third person may connect incorrectly to the network by the certificate which ought to have been canceled and may obtain secrete information.
An object of the present invention is to solve the aforementioned problems and to provide a managing method for information relating to revocation of a certificate and an information processing apparatus as a node composing the network. In a network composed of a plurality of nodes wherein the nodes certificate mutually and can communicate directly, when a certificate is revoked due to withdrawal of a node, for immediately reflecting the information on the revocation of the certificate to the revocation lists CRL of the other existing nodes and preventing a danger of unfair connection within the time until the CRLs are updated.